Add Wireguard playbook and first commit

roles/homelab/wireguard/templates/client.conf.j2

@@ -0,0 +1,10 @@
+[Interface]
+PrivateKey = {{ item.1.content | b64decode | trim }}
+Address = {{ item.0.address }}/32
+DNS = {{ wireguard_dns }}
+
+[Peer]
+PublicKey = {{ wg_server_pubkey.stdout }}
+Endpoint = {{ wireguard_remote_address }}:{{ wireguard_port }}
+AllowedIPs = {{ item.0.allowed_ips }}
+PersistentKeepalive = 25

roles/homelab/wireguard/templates/db.serti.fun.j2

@@ -0,0 +1,22 @@
+$TTL 3600
+@       IN  SOA wireguard.serti.fun. admin.serti.fun. (
+            1           ; serial
+            3600        ; refresh
+            1800        ; retry
+            604800      ; expire
+            3600        ; minimum
+        )
+
+; Name servers
+@       IN  NS  wireguard.serti.fun.
+
+; A records
+wireguard   IN  A   {{ wireguard_address }}
+
+@                   IN  A       {{ wireguard_remote_address }}
+{% set apache2 = wireguard_clients | selectattr('name', 'equalto', 'apache2') | first %}
+{% for sub in subdomains %}
+{{ sub }}           IN  A       {{ apache2.address }}
+{% endfor %}
+
+*           IN  A   {{ wireguard_remote_address }}

roles/homelab/wireguard/templates/mirror-yandex.ru.j2

@@ -0,0 +1,8 @@
+deb http://mirror.yandex.ru/debian/ trixie main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian/ trixie main non-free-firmware
+
+deb http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware
+
+deb http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware

roles/homelab/wireguard/templates/named.conf.local.j2

@@ -0,0 +1,10 @@
+zone "serti.fun" {
+	type primary;
+	file "/etc/bind/db.serti.fun";
+	allow-transfer { none; };
+	allow-update { none; };
+	allow-query {
+		127.0.0.1;
+		{{ wireguard_network }};
+	};
+};

roles/homelab/wireguard/templates/nftables.conf.j2

@@ -0,0 +1,47 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+	set home_net {
+		type ipv4_addr
+		flags interval
+		comment "Home subnet"
+		elements = {100.222.5.0/24}
+	} 
+	set iot_net {
+		type ipv4_addr
+		flags interval
+		comment "iOT subnet"
+		elements = {100.222.6.0/24}
+	} 
+	set vpn_net {
+		type ipv4_addr
+		flags interval
+		comment "iOT subnet"
+		elements = {100.222.11.0/24}
+	} 
+
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		iif lo accept comment "Accept any localhost trafic"
+		ct state invalid drop comment "Drop invalid connection"
+		fib daddr . iif type != {local, broadcast, multicast} drop
+		ct state { established, related } accept
+
+		#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"
+
+		tcp dport 22 accept comment "Allow ssh connection from home subnet"
+		ip saddr @vpn_net tcp dport 53 accept comment "Allow ssh connection from home subnet"
+
+		ip saddr @vpn_net udp dport 53 accept comment "Allow ssh connection from home subnet"
+		udp dport {{ wireguard_port }} accept comment "Wireguard port"
+	}
+	chain forward {
+		type filter hook forward priority filter;
+	}
+	chain output {
+		type filter hook output priority filter;
+	}
+}

roles/homelab/wireguard/templates/wg0.conf.j2

@@ -0,0 +1,12 @@
+[Interface]
+Address = {{ wireguard_address }}/24
+ListenPort = {{ wireguard_port }}
+PrivateKey = {{ wg_server_privkey_content.content | b64decode | trim  }}
+
+{% for peer in wireguard_clients %}
+{% set peer_pubkey = peer_pubkey.results[loop.index0].stdout %}
+#Peer: {{ peer.name }}
+[Peer]
+PublicKey = {{ peer_pubkey }}
+AllowedIPs = {{ peer.address }}
+{% endfor %}